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Information Commissioner's Office 


ICO call for views on a data protection and 
journalism code of practice 


The Information Commissioner is calling for views on a data 
protection and journalism code of practice (the code). 


The Data Protection Act 2018 requires the Commissioner to produce 
a code of practice that provides practical guidance and promotes 
good practice in regard to processing personal data for the purposes 
of journalism. Our intention is for the code to provide practical, 
pragmatic guidance for journalists on how to comply with data 
protection legislation, building on the detailed guidance that we 
have already produced for this sector. 


This call for views is the first stage of the consultation process. The 
Commissioner is seeking input from relevant stakeholders, including 
media organisations, trade associations, data subjects and those 
representing the interests of data subjects. For further information 
on the call for views, please read our blog post here. 


We will use the responses we receive to inform our work in 
developing the code. 


You can email your response to journalismcode@ico.org.uk. 


Or print and post to: 


Journalism Code Call for Views 
Policy & Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


The call for views will be open until Monday 27th May 2019. 
Privacy statement 


For this consultation we will publish all responses except for those 
where the respondent indicates that they are an individual acting in 
a private capacity (e.g. a member of the public). All responses from 
organisations and individuals responding in a professional capacity 
(e.g. academics, freelance journalists, sole traders, legal 
professionals) will be published. We will remove email addresses 
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and telephone numbers from these responses but apart from this 
we will publish them in full. 


For more information about what we do with personal data please 
see our privacy notice. 

RESPONSE: 

This response is made on behalf of Newsquest Media Group, 


publisher across the UK of some 200 local newspaper and magazine 
titles, in print and online. 


<4 > 


NEWSQUEST —> 
Questions 


Qi We are considering using our current guidance "Data 
protection and journalism: a guide for the media” as the basis 
on which we will build the new journalism code. Do you agree 
or disagree with this approach? 


Agree. 


Although the working title of the new document appears to be 
“Journalism Code”, it is important that the status and purpose 
of the old document as non-prescriptive guidance to the 
media is repeated in the new. The ICO has already 
acknowledged that it does not act as a media regulator. And 
the legislation is already complicated enough without adding 
more inflexible rules, unless they are clearly supported by 
existing law. The document should be an aid to interpretation 
of the law, not an expansion of it. The document should 
properly convey that the media’s responsibilities under the 
journalistic exemption are predicated on the ‘reasonableness’ 
of the editor’s belief in all the circumstances, allowing for that 
legally-protected margin of subjective editorial discretion that 
recognises the social and political importance of a free and 
independent media. 


Q2 If you disagree, please explain why? 
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N/A 


Q3 "Data protection and journalism: a guide for the media” is 
split into three sections: 


- “Practical guidance” aimed at anyone working in the 
journalism sector; 


- “Technical guidance” aimed at data protection practitioners 
within media organisations; and 


- “Disputes”, aimed at senior editors and staff responsible for 
data protection compliance. 


Do you think we should retain this structure for the code? 


Yes 
[_] No 


Q4 If no, do you have any suggestions about how we should 
structure the code? 


N/A 


Q5 Do you think the ICO’s existing guidance for journalists 
addresses the main areas where data protection issues 
commonly arise? 


L Agree 
Disagree 
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Q6__siIf no, what additional areas would you like to see covered? 


e The existing guidance contains helpful explanations of the 
wide scope of the public interest in reporting local events 
and matters of general interest and it supports the principle 
that there is an inherent public interest in the maintenance 
of a free press (p34). It is vital that this guidance is 
maintained and amplified. Much local newspaper reporting 
covers ordinary everyday matters, which may often appear 
relatively insignificant. But this is the stuff of reality and it 
reflects the daily triumphs and tragedies of the communities 
we support and the lives of the people who live in them. 
There is an essential public interest in receiving an 
unhindered flow of information to help people understand 
the world we live in and aid democratic debate. This has 
always been the case and, in our view, GDPR is not meant 
to take us backwards. More could still be done in the new 
guidance to emphasise the fundamental importance of the 
right of free expression and information in an open society, 
because (in our experience) complainants from among the 
general public have an exaggerated and mistaken 
understanding of their rights under data protection 
legislation to restrict or control those freedoms, though they 
do generally accept the point when it is cogently explained. 
As Article 10 of the Convention Rights says, any restriction 
on free expression must always be justifiable as being 
necessary in a democratic society and proportionate to its 
proper purpose; it will depend on a balancing exercise that 
assesses the relative importance of the competing interests 
in the specific circumstances of each case. 


e The new guidance should make clear that press standards 
are determined in accordance with the Editors’ Code under 
the supervision of the regulator, IPSO, and compliance with 
the Code is prima facie an indicator of reasonableness. The 
ICO has acknowledged that it is not there to supplant the 
media regulator. 


e While archives are touched on in the existing guidance, they 
are mentioned only in passing. This is inconsistent with the 
high level of demand for Article 17 erasure from archives we 
receive from the public, particularly in relation to archived 
reports of wrongdoing of one kind or another. GDPR at 
Recital 153 now highlights the importance of newspaper 
archives and this should be adequately reflected in the ICO’s 
guidance. The archives, in print and now online, are integral 
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to the journalistic purpose, and have been throughout the 
300-year history of newspapers. The free press cannot 
perform its recognised role as “watchdog” of government, 
judiciary and society in general unless we can give access to 
the public to a searchable record of past and present that 
reveals patterns and changes. The archives of local 
newspapers are especially important because (of course) 
news always begins locally somewhere. And they are often 
the only historical record available locally. They serve as the 
collective memory of each of the communities we serve. 
They tell us who we are, warts and all. It is vital for health 
of our democracy that we should protect the integrity of this 
rich resource for the future. 


The old guidance helpfully explains that the journalistic 
exemption is assessed when the information is collected 
“with a view to publication” and will apply “end to end” 
(p32) in relation to all processing before and after 
publication. But the new guidance should be more explicit 
that legitimate publication under the journalistic exemption 
means that a story is legitimately held in the same form in 
the archive without further obligation to review the 
exemption after time. It is important to distinguish the 
exemption from an Article 6 basis for lawful processing, 
such as the processing of personal data for legitimate 
interests, which may have to be kept under review. The 
journalistic exemption expressly excludes the obligations 
connected with the categories of lawful processing (where 
they are reasonably believed to be incompatible with 
journalism) - DPA 2018 paragraph 26(9)(a)(ii) of Part 5 of 
Schedule 2. Clearer wording in this area will help us to 
answer those people who contact us insisting on the 
deletion of an archived report about them because of the 
elapse of time, changes in their life since publication or 
simply their personal distress at its retention in the archive. 


We accept that the journalistic exemption for archived 
material is usually qualified by the obligation of accuracy, 
which is likely to be compatible with the journalistic process 
in most circumstances (and generally it is the very objective 
of the journalistic purpose). To that end our privacy notice 
states that we will take appropriate steps if significant 
factual inaccuracies are demonstrated to us in archived 
stories. We use the adjective ‘significant’ advisedly, because 
that is the level of care set by the Editors’ Code. If there 
was error at the time of publication, appropriate steps may 
include direct amendment to the archived copy or suitable 
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annotation and/or publication of a fresh correcting 
statement (linking to the original). We will also apologise for 
a significant inaccuracy arising from our error. Often 
inaccuracy is not at all the result of any error but rather an 
absence of information at the time in spite of the newspaper 
having taken due care. In such cases, the original 
publication forms part of the evolution of the story and any 
correction is likely to be by way of annotation, and possibly 
a follow-up story if circumstances demand it. Our privacy 
notice also states that we will, if we consider it appropriate, 
annotate an archived story and/or publish a follow-up 
reporting a significant new development or update (eg a 
successful appeal in a court case), but leaving the original 
story untouched as part of the historical record. Many of 
our readers do not appreciate that new developments do 
not re-write history or require the erasure of the historical 
record. 


e The role of news agencies and freelance contributors should 
be addressed. What is the controller/processor relationship 
between them? This will vary. The local press may engage 
freelancers on shift work (eg photographers) who may be 
subject to newsroom direction, but mostly the local press 
will receive copy or pictures which have been independently 
produced and submitted. The question then arises to what 
extent the editor may be entitled to rely on the copy 
produced by an experienced and professional independent 
freelance or agency when assessing the application of the 
journalistic exemption. Our view is that, in the absence of 
contrary indicators, it is reasonable to rely on the accuracy 
of submitted materials from known and trusted agencies 
with a demonstrable track-record of reliability, though more 
care may be required in other cases. 


e Subject access requests (Art 15 GDPR). The new guidance 
should clarify that the journalistic exemption will apply to 
unpublished journalistic material, and also the publisher is 
not required to provide copies of material that has been 
published but is available to the applicant in the publisher’s 
online archive. 


Q7 The journalism code will address changes in data protection 
law, including developments in relevant case law. Are there 
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There is whole raft of new data subject rights in Articles 16- 
20, each of which should be assessed in the new guidance 
in relation to the journalistic purpose and the exemption. 


Right of erasure under Art 17 is likely to be incompatible 
with the journalistic purposes in our view, unless possibly 
an article is shown to be fundamentally wrong in fact or 
it is unlawful for some reason (and therefore not serving 
a “necessary” purpose). Where an article is still viable 
but there is demonstrable and significant inaccuracy, 
correction is more appropriate, which may be achieved 
by annotation in archive and/or publication of a 
statement as the Editors’ Code provides. 


Rights of erasure or of rectification (Art 16) for 
inaccuracy must be confined to significant factual 
inaccuracies (to be consistent with the Editors’ Code). 
The new guidance in relation to alleged inaccuracies 
should also acknowledge the relevance of legal principles 
in statute and common law such as: privilege (eg for 
reports of courts, local authorities, police and 
governmental notices); principles of judicial construction 
(eg meanings must be understood in the context of the 
whole article and relevant circumstances); the difference 
between fact and opinion; and the latitude given for 
journalism (eg reports of courts or council committees do 
not need to be comprehensive; a simple listing of a 
conviction of a criminal offence may in itself be a fair and 
accurate report). 


Right to restrict processing under Art 18: the notion that 
a mere complaint could prevent proper journalistic 
enquiries in the absence of any proven data protection 
breach is inimical to the journalistic purpose and the 
exemption will surely apply. 


Right to data portability under Art 20: the proposition 
that an interviewee or other person co-operating with a 
newspaper might have a right to demand the work 
product of the newspaper, before or after publication, in 
order to pass it on to third parties, including perhaps 
another publisher, is similarly incompatible with the 
journalistic purpose and conflicts with the copyright of 
the publisher. 
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- Right to notification under Art 19: to the extent that the 
right of notification could apply to journalistic work 
(bearing in mind the above), the guidance should 
acknowledge that a published correction or archive 
annotation is likely to be sufficient. 


Q8 Apart from recent changes to data protection law, are there 
any other developments that are having an impact on 
journalism that you think we should address in the code? 


e Commercial and technological developments, in particular 
the move online, means that obligations for evidencing or 
recording a newspaper’s reliance on the special purposes 
exemption (where such recording is required at all), should 
be flexible and not overly prescriptive. Anything else is likely 
to be unmanageable because editorial teams are much 
leaner and the hierarchy much flatter, with many day-to- 
day decisions being taken by reporters uploading directly 
online. Obligations to record in writing would be a 
disproportionate requirement and needlessly disruptive. We 
believe that in most cases evidence of decision-making by 
reference to internal policies or relevant editorial codes 
should be sufficient, and the expectation of a written record 
should be exceptional. It would not apply to routine or 
everyday matters, or reports of courts, councils and other 
privileged occasions where the public interest is obvious. It 
may be helpful in connection with investigations or other 
stories involving a serious degree of intrusion or disclosure 
of private sensitive personal data in the special categories, 
or other similarly important private interests, but it should 
not be a prescriptive requirement of the guidance. 


Q9 Are there any case studies or journalism scenarios that you 
would like to see included in the journalism code? 


This would not be appropriate in our view. If the guidance as 
regards the journalistic exemption is properly based on the 
interpretation and application of basic principles, allowing for a 
range of reasonable responses in the circumstances of each case, 
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then giving judgments made on particular case studies is more 
likely to be unhelpful than helpful. 


Q10 Do you have any other suggestions for the journalism code? 


Current guidance states (p 10) that data controllers "will 
need a valid reason" for not notifying the subject of a 
journalistic investigation that their data is being collected 
and that this "justification should reflect the privacy 
intrusion". This suggest that notification is usually required 
and the justification for not doing so rises according to the 
degree of privacy intrusion. This is not consistent with law. 
In Mosley v United Kingdom (2012), the European Court of 
Human Rights decided that the right of privacy guaranteed 
by Article 8 of the European Convention on Human Rights 
does not require the media to give prior notice of intended 
publications to those who feature in them. The new 
guidance should be consistent with the law. 


Various references to the public interest in the exposure of 
“wrongdoing” and /or “incompetence” in the current 
guidance (eg pages 11, 41, and 42 ) should be expanded 
to clarify that they include allegations of wrongdoing. 


On the question of incompatibility with the journalistic 
purpose, the current guidance appears to overstate the case 
by introducing new hurdles to clear in addition to the 
editor’s reasonable belief. These deny the editor any real 
latitude for decision-making. At one point on (p37) it is 
said: "there must be a clear argument that the provision in 
question presents an obstacle to responsible journalism”. 
The guidance then goes on to say it must be “impossible to 
both comply with a particular provision and to fulfil your 
journalistic purpose”. And at page 39 it is said that: “...even 
if a story is clearly in the public interest, if a journalist can 
reasonably research and present it in a way that complies 
with the standard provisions of the DPA, they must”. It 
appears to us that these provisions in the guidance impose 
requirements significantly beyond an ordinary assessment 
of the reasonableness of an editor’s subjective belief. The 
guidance rather suggests that a publisher will always be 
wrong if there is an alternative way of doing something 
which would obviate reliance on the exemption. In our view, 
this is incorrect. It denies the editorial margin of discretion 
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and the freedom of the press to report a story in the way 
that it reasonably considers to be appropriate. This also puts 
the ICO in the role of editor-in-chief, a role that the ICO has 
previously acknowledged it does not and should not have. 
But the law as expressed through Article 10 of the 
Convention Rights protects both the substance of the 
information contained in a report and crucially also the form 
in which that information is expressed. We refer in particular 
to the seminal case of Jersild v Denmark ECHR 1994. The 
European Court of Human Rights found that freedom of 
expression is one of the essential foundations of a 
democratic society and the safeguards to be afforded to the 
press are of particular importance. It went on to say that 


“The methods of objective and balanced reporting may vary 
considerably, depending among other things on the media 
in question. It is not for this court, nor for the national 
courts for that matter, to substitute their own views for 
those of the press as to what technique of reporting should 
be adopted by journalists. In this context the court recalls 
that Article 10 protects not only the substance of the ideas 
and information expressed, but also the form in which they 
are conveyed.” 


Statute an common law in the UK is infused with this 
principle wherever it deals rights of free expression. For 
example, section 4(4) of the 2013 Defamation Act expressly 
requires latitude for editorial judgment. in the UK is infused 
with this basic principle: In determining whether it was 
reasonable for the defendant to believe that publishing the 
statement complained of was in the public interest, the 
court must make such allowance for editorial judgement as 
it considers appropriate. 


The new guidance should not repeat the parts of the old 
guidance which impose a more restrictive interpretation, but 
should rather explain that a story will qualify for the 
journalistic exemption provided that that the data controller 
reasonably believes there is an editorial justification for his 
or her chosen treatment. 


e Confidential sources: On page 16 of the current guidance, it 
is suggested that the media controller might have to 
disclose confidential sources “if it is reasonable to do so”. 
This seriously devalues the protection given in UK law 
(section 10 Contempt of Court Act 1981) which protects 
journalists against such disclosure except where a court 
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rules that disclosure is actually necessary in the interests of 
justice or national security or for the prevention of disorder 
or crime. The new guidance should be consistent with the 
law. 


About you 


O 
is 
p 


O duuu] 


Are you answering these questions as? 

A media organisation? 

A trade association? 

An organisation representing the interests of data subjects? 
An academic? 

An individual acting in a professional capacity? 

An organisation that regulates press standards? 


An individual acting in a private capacity (e.g. someone 


providing their views as a member of the public)? 


Other? 


If you answered ‘other’ please specify: 


Q12 How did you find out about this survey? 


MOO JOOO 


ICO website 

Social media 
Conference/seminar 
Trade/professional association 
Media 

Word of mouth 

Other? 
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Q13 We may want to contact you about some of the points you 
have raised. If you are happy for us to do this please provide 
your email address: 


Thank you for taking the time to share your views and experience. 


Journalism Code of Practice - Call for views 
20190429 v1.0 


